Open tjuTangSong opened 1 year ago
Branch: master Commit: cbb9b101d18e4c1682ca39a52a201d8e4241ea17 POC is:
master
cbb9b101d18e4c1682ca39a52a201d8e4241ea17
async function f1() { await null; throw WScript.f2a(f1()); } f1(); async function f2() { async function f2a() { throw "err"; } async function f2b() { try { var p = f2a(); } catch (e) { console.log("caught " + e); } } async function f2c() { var p = f2a(); } f2b(); f2c(); } f2();
In release build ./build.sh --sanitize=address --static -j I get:
./build.sh --sanitize=address --static -j
AddressSanitizer:DEADLYSIGNAL ================================================================= ==10354==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000020 (pc 0x55d5e2d0b000 bp 0x7ffd7e5a66e0 sp 0x7ffd7e5a66e0 T0) ==10354==The signal is caused by a READ memory access. ==10354==Hint: address points to the zero page. #0 0x55d5e2d0afff in Js::EntryPointInfo::HasInlinees() (/root/ChakraCore-latest/out/Release/ch+0x6e3fff) #1 0x55d5e343229f in Js::InlinedFrameWalker::FromPhysicalFrame(Js::InlinedFrameWalker&, Js::Amd64StackFrame&, Js::ScriptFunction*, bool, int, Js::JavascriptStackWalker const*, bool, bool) (/root/ChakraCore-latest/out/Release/ch+0xe0b29f) #2 0x55d5e34333d4 in Js::JavascriptStackWalker::UpdateFrame(bool) (/root/ChakraCore-latest/out/Release/ch+0xe0c3d4) #3 0x55d5e342e90f in Js::JavascriptStackWalker::Walk(bool) (/root/ChakraCore-latest/out/Release/ch+0xe0790f) #4 0x55d5e343537e in Js::JavascriptStackWalker::GetCaller(Js::JavascriptFunction**, bool) (/root/ChakraCore-latest/out/Release/ch+0xe0e37e) #5 0x55d5e3435f56 in Js::JavascriptStackWalker::GetCaller(Js::JavascriptFunction**, Js::ScriptContext*) (/root/ChakraCore-latest/out/Release/ch+0xe0ef56) #6 0x55d5e33dfe6d in Js::JavascriptOperators::PatchGetMethodFromObject(void*, Js::RecyclableObject*, int, Js::PropertyValueInfo*, Js::ScriptContext*, bool) (/root/ChakraCore-latest/out/Release/ch+0xdb8e6d) #7 0x55d5e33dfaf7 in Js::JavascriptOperators::PatchGetMethodNoFastPath(Js::FunctionBody*, Js::InlineCache*, unsigned int, void*, int) (/root/ChakraCore-latest/out/Release/ch+0xdb8af7) #8 0x55d5e3450c85 in void* Js::ProfilingHelpers::ProfiledLdFld<false, true, false>(void*, int, Js::InlineCache*, unsigned int, Js::FunctionBody*, void*) (/root/ChakraCore-latest/out/Release/ch+0xe29c85) #9 0x55d5e3127bcf in Js::InterpreterStackFrame::ProcessProfiled() (/root/ChakraCore-latest/out/Release/ch+0xb00bcf) #10 0x55d5e30791dd in Js::InterpreterStackFrame::Process() (/root/ChakraCore-latest/out/Release/ch+0xa521dd) #11 0x55d5e307756f in Js::InterpreterStackFrame::InterpreterHelper(Js::ScriptFunction*, Js::ArgumentReader, void*, void*, Js::InterpreterStackFrame::AsmJsReturnStruct*) (/root/ChakraCore-latest/out/Release/ch+0xa5056f) #12 0x55d5e30768ab in Js::InterpreterStackFrame::InterpreterThunk(Js::JavascriptCallStackLayout*) (/root/ChakraCore-latest/out/Release/ch+0xa4f8ab) #13 0x7f6f2c750f99 (<unknown module>) #14 0x55d5e3961ffd in amd64_CallFunction (/root/ChakraCore-latest/out/Release/ch+0x133affd) #15 0x55d5e35ed2d5 in Js::JavascriptGenerator::CallGenerator(void*, Js::ResumeYieldKind) (/root/ChakraCore-latest/out/Release/ch+0xfc62d5) #16 0x55d5e35ac1dc in Js::JavascriptAsyncFunction::AsyncSpawnStep(Js::JavascriptAsyncSpawnStepFunction*, Js::JavascriptGenerator*, void*, void*) (/root/ChakraCore-latest/out/Release/ch+0xf851dc) #17 0x55d5e35ac9eb in Js::JavascriptAsyncFunction::EntryAsyncSpawnCallStepFunction(Js::RecyclableObject*, Js::CallInfo, ...) (/root/ChakraCore-latest/out/Release/ch+0xf859eb) #18 0x55d5e381e5ee in Js::JavascriptPromise::EntryReactionTaskFunction(Js::RecyclableObject*, Js::CallInfo, ...) (/root/ChakraCore-latest/out/Release/ch+0x11f75ee) #19 0x55d5e3961ffd in amd64_CallFunction (/root/ChakraCore-latest/out/Release/ch+0x133affd) #20 0x55d5e35dda61 in Js::JavascriptFunction::CallRootFunctionInternal(Js::RecyclableObject*, Js::Arguments, Js::ScriptContext*, bool) (/root/ChakraCore-latest/out/Release/ch+0xfb6a61) #21 0x55d5e35dd72f in Js::JavascriptFunction::CallRootFunction(Js::Arguments, Js::ScriptContext*, bool) (/root/ChakraCore-latest/out/Release/ch+0xfb672f) #22 0x55d5e2ad675a in JsCallFunction (/root/ChakraCore-latest/out/Release/ch+0x4af75a) #23 0x55d5e29feb1a in WScriptJsrt::CallbackMessage::CallFunction(char const*) (/root/ChakraCore-latest/out/Release/ch+0x3d7b1a) #24 0x55d5e29db804 in RunScript(char const*, char const*, unsigned long, void (*)(void*), void*, char*, void*) (/root/ChakraCore-latest/out/Release/ch+0x3b4804) #25 0x55d5e29de913 in ExecuteTest(char const*) (/root/ChakraCore-latest/out/Release/ch+0x3b7913) #26 0x55d5e29df606 in main (/root/ChakraCore-latest/out/Release/ch+0x3b8606) #27 0x7f6f30c78c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) #28 0x55d5e28ddd59 in _start (/root/ChakraCore-latest/out/Release/ch+0x2b6d59) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV (/root/ChakraCore-latest/out/Release/ch+0x6e3fff) in Js::EntryPointInfo::HasInlinees() ==10354==ABORTING
I think it is a bug, also without sanitizer on it would fail an assertion instead.
Severity 2 on this and others that get an assert.
Branch:
master
Commit:cbb9b101d18e4c1682ca39a52a201d8e4241ea17
POC is:In release build
./build.sh --sanitize=address --static -j
I get: